How to let Logstash start indexing into Elasticsearch on specific Word

Elastic Stack Logstash
1

hello Folks,
i am trying to insert(indexing) some unstructured Sentences from my Text editor into Elasticsearch, and only when Logstash arraive a specific Word than start to index all other Words and sentences after this Specific word in one Field,
My Example Log Data in my text editor,

example4
example4.jpg1008×630 52.4 KB

I want to start indexing the sentences from the text editor after the word "FINAL"
my Try until now did not work perfectly, because of the whitespaces and emptyLines between each sentence,

filter {
if [message] =~ "^\s*$" {
drop { }
}
grok {
match => { "message" => "\s+%{GREEDYDATA}FINAL\n\s+%{GREEDYDATA:sentences}"}
}

Can anybody help me to correct my filter?
thx.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.